Perplexity Open-Sources SPACE Sandbox for AI Agents

MarkTechPost reported that release 0.8.0, described as the public baseline, is a Rust codebase exposing an HTTP API and server-sent events. It runs on a Linux x86_64 host with KVM, /dev/kvm, btrfs and Docker, in local Kind Kubernetes or direct mode, and does not run on macOS.

Applications call the HTTP API to create Linux environments, run commands and stream output. A template supplies the starting filesystem, and a sandbox is one instance of that template with its own VM and writable disk; many commands can run inside one sandbox. Perplexity's launch thread said agents run commands, install packages and call services with root inside the sandbox, while the host stays outside the guest's control. Agent work is long-running, stateful and branching, so it must survive restarts. Each sandbox has its own guest kernel, and a per-sandbox network gateway on the host enforces egress policy on every outbound connection. Secrets never enter the guest, according to Perplexity's July engineering post, because credentials are injected at the network layer. The credential store adds hierarchical scoping, rate limits and audit logging. The architecture guide splits the system into a PostgreSQL-backed API, controllers, worker services and a data plane; workers manage VMs, networking, volumes, templates and credentials, and btrfs copy-on-write creates each root filesystem.

Sandboxes move through four states: running, paused, suspended and deleted. A paused sandbox keeps VM memory resident on the worker and is not a durable snapshot. A suspended sandbox snapshots VM memory, runtime state and the root filesystem and releases active resources. By default, sandboxes suspend after six hours without activity. Kubernetes deployments use warm pools of booted sandboxes for fast creates, while single-node setups use base snapshots. In production, median create latency fell to 60 ms from 185 ms versus Perplexity's previous provider, and 90th-percentile create latency fell to 89 ms from 447 ms. Perplexity said 100% of Computer sessions run on SPACE.

Perplexity's "Escaping SPACE: Part I" report tested nine models with root inside the guest, running 216 runs across two tasks and four settings. No sandbox-escape run reached the host-side secret, or 0 of 108; no-network bypass succeeded in 0 of 54 runs. Before fixes, partial-network bypass succeeded in 11 of 54 runs, and four models found a path: Claude Opus 5.0, GPT-5.6 Sol, GPT-5.6 Cyber and Kimi K3. The attacks used DNS spoofing and shared CDN IP addresses. Perplexity then added source-address validation through nftables, and the gateway now terminates TLS and checks both SNI and HTTP host against the allowlist. In the retest, no model produced a verified bypass.

The same team tested 10 third-party platforms, and eight showed at least one network-policy bypass, according to MarkTechPost. Perplexity disclosed the results to every affected vendor.